Project presentation ASSET - ADAPTIVE SECURITY FOR SMART INTERNET OF THINGS IN EHEALTH

Transcription

1 Project presentation ASSET - ADAPTIVE SECURITY FOR SMART INTERNET OF THINGS IN EHEALTH Habtamu Abie, Dr. Scient., Principal Scientist ASSET Project Manager Norwegian Computing Center Tuesday 19 th of March 2013, 09:30-17:00, Telenor, Oslo, Norway.

2 The ASSET Project IoTs can improve eheath Digital Health Ecosystems and IOT IoTs simplify everyday life and improve quality of lives IoTs are also vulnerable to attacks Goals and objectives Project partners Case study: Patient monitoring ASSET lab setup Summary

3 Digital Health Ecosystems create digital environments for networked health organizations IoT is one of the building blocks of the digital health ecosystem Source: L. D. Serbanati et al., Steps towards a digital health ecosystem, Journal of Biomedical Informatics, 44(4), August 2011,

4 IoTs can improve quality of lives at home, while travelling, when sick, at work, when jogging, and/or at gym Can be used to track objects and people identify and authenticate people collect and sense data automatically Source: Digital Medicine

5 IoTs are also vulnerable to attacks Communication is wireless Limited physical security No centralized control Energy and computationally constrained operations Dynamic topology and behavior Unwanted side-effects of deployment in new context photos.com, 2013

6 Context-aware adaptive security for IoT from three related viewpoints: from the Things that are connected from the environments in which they are situated, and from the interactions that occur between Things, their environments and their human users Some types of modern IoT applications require instant adaptation of their security mechanisms due to their exposure to increasing situational dynamics

7 Motivating Projects FP7 GEMOM Genetic message-oriented secure middleware utrustit - Usable TRUST in the Internet of Things e-sense - Capturing Ambient Intelligence for Mobile Communications through Wireless Sensor Networks UbiSec&Sens - Ubiquitous Security and Sensing in the European Homeland National PETweb I & II Privacy-respecting Identity Management for e-norge SAMPOS - Strategies for Seamless Deployment of Mobile Patient Monitoring Systems

8 Goals and objectives Goals develop risk-based adaptive security methods and mechanisms for IoT in ehealth adapt to dynamic changing conditions of IoT, including usability, threats, and diversity/heterogeneity Objectives Build risk estimating and predicting models Build methodology for security measurement and metrics Prototype and validate the adaptive methods in patient monitoring scenarios in Oslo University Hospital Build light-weight abilities in smart things

9 Project partners National Partners Norwegian Computing Center Gjøvik University College Oslo University Hospital International partners VTT Technical Research Center of Finland Queen Mary University of London 2 PhD fellows and 2 Master s students Risk estimation and prediction Risk-based adaptive security Adaptive lab and simulation testbed for IoT in ehealth Adaptive intrusion detection for WBAN

10 Risk-based security adaptation Risk-based adaptation access could be authorized according to the measured risk measurable risk to strengthen the security of IoT systems Implements quantified risk adaptive security solutions measuring risk establishing an acceptable risk level ensuring that the information is used, accessed and distributed all the way up to the acceptable risk level Self-adaptiive risk-based protection Based on risk levels, automatically adjust the settings and actions to satisfy protection requirements of the new operating conditions

11 Alignment of ISMS, ISRM and ASSET Information Security Management System (ISMS) Process Plan Do Check Act Information Security Risk Management (ISRM) Process Establishing the context Risk assessment Risk treatment planning Risk acceptance Implementation of risk treatment plan Continual monitoring and reviewing of risks Maintain and improve the Information Security Risk Management Process ASSET Adaptive Risk Management Process/Methodology Analyze (Plan) Adapt (Execute) Monitor Adapt (Learn) ISO/IEC 27005:2007 ASSET: Monitor-Analyze-Adapt (plan, learn, execute)

12 Risk-based Adaptive Security Framework Alignment of ISMS and ASSET Processes ISMS Process Plan Do Check Act ASSET Process Analyze (Plan) Adapt (Execute) Monitor Adapt (Learn) H. Abie and I. Balasingham, Risk-Based Adaptive Security for Smart IoT in ehealth, 7th International Conference on Body Area Networks (BODYNETS 2012)

13 Case Study: Patient Monitoring Patient monitoring systems major data source in healthcare environments maintain a certain level availability quality of service (QoS) security and privacy of the patient Two different scenarios home environments hospital environments

14 The Home Scenario and its Core Scenarios

15 The Hospital Scenario and its Core Scenarios

16 ASSET Lab Set Up EEG Blood pressure SpO 2 ECG Relay node PDA/Tablet Heartbeat WBAN Controller Patient monitoring EMG Patient monitoring Data Center Acronyms - ECG (Electrocardiography) - EEG (Electroencephalography) - SpO2 (Oxygen Saturation) - EMG (Electromyography) - WBAN (Wireless Body Area Network) Devices in use: - Smartphones: Sony Xperia, Galaxy Nexus - Motes: Shimmer kit - Dash7: Wizzikit - Tablet Samsung Galaxy 10 - PCs: Laptops Radio types: - IEEE Wifi - Bluetooth -ZigBee - NFC - GPRS/ GSM Sensor types: - Heartbeat, blood pressure, blood sugar level - EEG, ECG, EMG, temperature, light, humidity - Accelerometer, Gyro, Magnetometer, GSR - Strain Gauge, GPS, Barometric Pressure, SpO2 - Vibration switch, NFC, proximity sensor, etc.

17 Summary Challenges models for accurately predicting future and unknown events and adapting accordingly adaptation causing minimal deviations from normal operation enabling adaptation across multiple time scales where and how much risk to take how could risk damages be controlled optimize algorithms for different IoT processing capabilities improve the light-weight abilities of smart things by improving their context-awareness and self-abilities

18 Summary An innovative risk-based adaptive security for IoT in ehealth identify unknown threats to IoT ehealth systems estimate and predict risk damages and future benefits adapt security decisions upon those predictions Goals increase understanding of, and thus ability to develop, techniques and algorithms for predicting unknown risk contribute to the IoT vision to become secure Internet of anything, anywhere, connected, anyhow

19 Thanks! The End!